linux-kernel - [GIT PULL] audit/audit-pr-20260203

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4d8d54dd3db528deba7eddf05201b1df@paul-moore.com>
Date: Tue, 03 Feb 2026 23:10:33 -0500
From: Paul Moore <paul@...l-moore.com>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: audit@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [GIT PULL] audit/audit-pr-20260203

Linus,

This is a bit early, but due to some personal scheduling I'd rather send
this to you now, and you always mention you prefer to get pull requests
early (perhaps not this early?) so here is hoping this is a win-win.

Here are the highlights for the audit changes queued for the Linux v7.0
merge window:

- Improve the NETFILTER_PKT audit records

Add source and destination ports to the NETFILTER_PKT audit records while
also consolidating a lot of the code into a new, singular
audit_log_nf_skb() function.  This new approach to structuring the
NETFILTER_PKT record generation should elimiate some unnecessary overhead
when audit is not built into the kernel.

- Update the audit syscall classifier code

Add the listxattrat(), getxattrat(), and fchmodat2() syscall to the
audit code which classifies syscalls into categories of operations, e.g.
"read" or "change attributes".

- Move the syscall classifier declarations into audit_arch.h

Shuffle around some header file declarations to resolve some sparse
warnings.

Paul

--
The following changes since commit 8f0b4cce4481fb22653697cced8d0d04027cb1e8:

  Linux 6.19-rc1 (2025-12-14 16:05:07 +1200)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
    tags/audit-pr-20260203

for you to fetch changes up to 76489955c6d4a065ca69dc88faf7a50a59b66f35:

  audit: move the compat_xxx_class[] extern declarations to audit_arch.h
    (2026-01-09 16:37:59 -0500)

----------------------------------------------------------------
audit/stable-7.0 PR 20260203
----------------------------------------------------------------

Ben Dooks (1):
      audit: move the compat_xxx_class[] extern declarations to
         audit_arch.h

Jeffrey Bencteux (2):
      audit: add fchmodat2() to change attributes class
      audit: add missing syscalls to read class

Ricardo Robaina (2):
      audit: add audit_log_nf_skb helper function
      audit: include source and destination ports to NETFILTER_PKT

 include/asm-generic/audit_change_attr.h |    3 
 include/asm-generic/audit_read.h        |    6 
 include/linux/audit.h                   |   14 +-
 include/linux/audit_arch.h              |    7 +
 kernel/audit.c                          |  159 ++++++++++++++++++++++++
 net/netfilter/nft_log.c                 |   58 --------
 net/netfilter/xt_AUDIT.c                |   58 --------
 7 files changed, 185 insertions(+), 120 deletions(-)

--
paul-moore.com